SAML2 SessionNotOnOrAfter support

**Description:**
support for SAML2's SessionNotOnOrAfter property of the <AuthnStatement> would be useful for enforcing an idle session timeout on Service Providers, and ensuring that service providers will refresh from the IdP within that timeframe to prevent an idle timeout.

**Suggested Labels:**
enhancement, Feature, Type/Improvement

**Affected Product Version:**
IS 5.4.0